All the vulnerabilites related to arista - extensible_operating_system
Vulnerability from fkie_nvd
Published
2019-10-10 19:15
Modified
2024-11-21 04:27
Severity ?
Summary
A vulnerability has been found in the implementation of the Label Distribution Protocol (LDP) protocol in EOS. Under race conditions, the LDP agent can establish an LDP session with a malicious peer potentially allowing the possibility of a Denial of Service (DoS) attack on route updates and in turn potentially leading to an Out of Memory (OOM) condition that is disruptive to traffic forwarding. Affected EOS versions include: 4.22 release train: 4.22.1F and earlier releases 4.21 release train: 4.21.0F - 4.21.2.3F, 4.21.3F - 4.21.7.1M 4.20 release train: 4.20.14M and earlier releases 4.19 release train: 4.19.12M and earlier releases End of support release trains (4.18 and 4.17)
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| arista | extensible_operating_system | * | |
| arista | extensible_operating_system | * | |
| arista | extensible_operating_system | * | |
| arista | extensible_operating_system | * | |
| arista | extensible_operating_system | 4.17 | |
| arista | extensible_operating_system | 4.18 | |
| arista | extensible_operating_system | 4.22.1f | |
| arista | 7020r | - | |
| arista | 7280e | - | |
| arista | 7280r | - | |
| arista | 7280r2 | - | |
| arista | 7280r3 | - | |
| arista | 7500e | - | |
| arista | 7500r | - | |
| arista | 7500r2 | - | |
| arista | 7500r3 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:arista:extensible_operating_system:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CF0622F4-B19E-4D53-A0AF-481F0D65AA87",
"versionEndIncluding": "4.19.12m",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arista:extensible_operating_system:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A1A9BBA3-708A-4F20-A9C1-54B1368D1BA8",
"versionEndIncluding": "4.20.14m",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arista:extensible_operating_system:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1F31FBFC-C81E-4BC1-AC4E-FBD0F0CD00B8",
"versionEndIncluding": "4.21.2.3f",
"versionStartIncluding": "4.21.0f",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arista:extensible_operating_system:*:*:*:*:*:*:*:*",
"matchCriteriaId": "49F87620-E066-4250-9745-A8B842612AFE",
"versionEndIncluding": "4.21.7",
"versionStartIncluding": "4.21.3f",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arista:extensible_operating_system:4.17:*:*:*:*:*:*:*",
"matchCriteriaId": "7DB48708-D409-4379-9F2C-170F3A1B53BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arista:extensible_operating_system:4.18:*:*:*:*:*:*:*",
"matchCriteriaId": "2C0823B5-1F76-4712-A17A-C43DCAA189DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arista:extensible_operating_system:4.22.1f:*:*:*:*:*:*:*",
"matchCriteriaId": "A96FAAFE-DB6E-40CA-A0FF-C9C76C8DF1C6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arista:7020r:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A3371EEF-9D7A-4EF6-A435-A0F1034E5EE7",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arista:7280e:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A6466FE3-DCE8-4DA5-B893-2BA864F73BC5",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arista:7280r:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C02B50F5-B316-4081-BC9E-6F1778049096",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arista:7280r2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "21CB1AAF-FC82-4A80-9932-42E8EFA3906A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arista:7280r3:-:*:*:*:*:*:*:*",
"matchCriteriaId": "60FC964C-9835-443A-A584-3A5D6022E914",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arista:7500e:-:*:*:*:*:*:*:*",
"matchCriteriaId": "06C61DCC-D1CF-4CE5-9634-4BE3E071E83E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arista:7500r:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FC651584-113E-4859-9F14-12D62F3BD626",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arista:7500r2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "583725F6-8583-425C-A847-700DBB9169E7",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:arista:7500r3:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1C6A4B3C-FF12-4DCD-9945-8450AD0BDEED",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in the implementation of the Label Distribution Protocol (LDP) protocol in EOS. Under race conditions, the LDP agent can establish an LDP session with a malicious peer potentially allowing the possibility of a Denial of Service (DoS) attack on route updates and in turn potentially leading to an Out of Memory (OOM) condition that is disruptive to traffic forwarding. Affected EOS versions include: 4.22 release train: 4.22.1F and earlier releases 4.21 release train: 4.21.0F - 4.21.2.3F, 4.21.3F - 4.21.7.1M 4.20 release train: 4.20.14M and earlier releases 4.19 release train: 4.19.12M and earlier releases End of support release trains (4.18 and 4.17)"
},
{
"lang": "es",
"value": "Se ha encontrado una vulnerabilidad en la implementaci\u00f3n del protocolo Label Distribution Protocol (LDP) en EOS. En condiciones de carrera, el agente de LDP puede establecer una sesi\u00f3n de LDP con un peer malicioso, permitiendo potencialmente la posibilidad de un ataque de Denegaci\u00f3n de Servicio (DoS) sobre las actualizaciones de ruta y, a su vez, conllevando potencialmente a una condici\u00f3n Out of Memory (OOM) que es perjudicial para el reenv\u00edo de tr\u00e1fico. Las versiones EOS afectadas incluyen: tren de publicaciones de 4.22: 4.22.1F y versiones anteriores; tren de publicaciones de 4.21: 4.21.0F hasta 4.21.2.3F, 4.21.3F hasta 4.21.7.1M; tren de publicaciones de 4.20: 4.20.14M y versiones anteriores; tren de publicaciones de 4.19: 4.19.12M y versiones anteriores; trenes de publicaciones de fin de soporte (4.18 y 4.17)"
}
],
"id": "CVE-2019-14810",
"lastModified": "2024-11-21T04:27:24.337",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-10-10T19:15:10.950",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/8321-security-advisory-42"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/8321-security-advisory-42"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-362"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
cve-2019-14810
Vulnerability from cvelistv5
Published
2019-10-10 18:07
Modified
2024-08-05 00:26
Severity ?
EPSS score ?
Summary
A vulnerability has been found in the implementation of the Label Distribution Protocol (LDP) protocol in EOS. Under race conditions, the LDP agent can establish an LDP session with a malicious peer potentially allowing the possibility of a Denial of Service (DoS) attack on route updates and in turn potentially leading to an Out of Memory (OOM) condition that is disruptive to traffic forwarding. Affected EOS versions include: 4.22 release train: 4.22.1F and earlier releases 4.21 release train: 4.21.0F - 4.21.2.3F, 4.21.3F - 4.21.7.1M 4.20 release train: 4.20.14M and earlier releases 4.19 release train: 4.19.12M and earlier releases End of support release trains (4.18 and 4.17)
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.arista.com/en/support/advisories-notices | x_refsource_MISC | |
| https://www.arista.com/en/support/advisories-notices/security-advisories/8321-security-advisory-42 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T00:26:39.049Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.arista.com/en/support/advisories-notices"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/8321-security-advisory-42"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in the implementation of the Label Distribution Protocol (LDP) protocol in EOS. Under race conditions, the LDP agent can establish an LDP session with a malicious peer potentially allowing the possibility of a Denial of Service (DoS) attack on route updates and in turn potentially leading to an Out of Memory (OOM) condition that is disruptive to traffic forwarding. Affected EOS versions include: 4.22 release train: 4.22.1F and earlier releases 4.21 release train: 4.21.0F - 4.21.2.3F, 4.21.3F - 4.21.7.1M 4.20 release train: 4.20.14M and earlier releases 4.19 release train: 4.19.12M and earlier releases End of support release trains (4.18 and 4.17)"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-10-10T18:07:51",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.arista.com/en/support/advisories-notices"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/8321-security-advisory-42"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-14810",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability has been found in the implementation of the Label Distribution Protocol (LDP) protocol in EOS. Under race conditions, the LDP agent can establish an LDP session with a malicious peer potentially allowing the possibility of a Denial of Service (DoS) attack on route updates and in turn potentially leading to an Out of Memory (OOM) condition that is disruptive to traffic forwarding. Affected EOS versions include: 4.22 release train: 4.22.1F and earlier releases 4.21 release train: 4.21.0F - 4.21.2.3F, 4.21.3F - 4.21.7.1M 4.20 release train: 4.20.14M and earlier releases 4.19 release train: 4.19.12M and earlier releases End of support release trains (4.18 and 4.17)"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.arista.com/en/support/advisories-notices",
"refsource": "MISC",
"url": "https://www.arista.com/en/support/advisories-notices"
},
{
"name": "https://www.arista.com/en/support/advisories-notices/security-advisories/8321-security-advisory-42",
"refsource": "CONFIRM",
"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/8321-security-advisory-42"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-14810",
"datePublished": "2019-10-10T18:07:51",
"dateReserved": "2019-08-10T00:00:00",
"dateUpdated": "2024-08-05T00:26:39.049Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}